lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 23 May 2010 22:05:14 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: stuart@...erdelix.net
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: denial-of-service vulnerability in the
	Microsoft Malicious Software Removal Tool

When I am logged in as Admin and try to replace NDIS.SYS, Windows
File Protection replaces it.  Why did WFP fail to protect the file
against Cutwail in the first place, and how can a virus replace
NDIS.SYS using Administrative privs, if I cannot do it myself when
Administrator?

You can't blame anyone for your incompetence, WFP is there to keep your
system running, not acting as an antivirus (today many people seem to think
that antiviruses should be put everywhere, starting from web browsers
themselves!)

If memory serves me right, in your case you just had to delete the file from
WFP cache folder and then the real file. The worst thing to you would be a 5
min search on Google.


Lastly, sure the system (might) be unbootable, but where's the virus?

You can boot into MS Recovery console and repair your system (missing driver
etc) but you can't do an antivirus scan reliably from recovery console; for
one thing such functionality is not available and another, antivirus can't
determine certain kinds of virii since they need to be at least loaded (if
not running) (example; MSI VBS-generic/self-mutating).

Cheers.



On Sun, May 23, 2010 at 9:43 PM, lsi <stuart@...erdelix.net> wrote:

> On 23 May 2010 at 23:57, webDEViL wrote:
>
> > All said and done, that doesn't make it a vulnerability.
>
> Tell that to my customer (wait until I've invoiced them, though).
>
> Stu
>
> ---
> Stuart Udall
> stuart at@...erdelix.dot net - http://www.cyberdelix.net/
>
> ---
>  * Origin: lsi: revolution through evolution (192:168/0.2)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists